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(54) Monitoring traffic in telecommunications networks 



(57) A method and apparatus for monitoring traffic 
in telecommunications networks, in particular applied to 
the problem of recognising real-time traffic such as voice 
traffic in packet- or cell-based networks through network 
traffic characterisation. The method (90, 92) classifies 
data traffic in a packet-based communications network 
conveying different classes of data through the monitor- 



ing of data traffic so as to identify sequences of data 
packets of unknown class transmitted between a source 
address and a destination address, subsequently meas- 
uring parameters of at least a significant part of the pack- 
et sequence and deriving from the measured parame- 
ters a probable classification of the data conveyed in the 
packet sequence. 
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Description 

[0001] The invention relates to a method and appara- 
tus for monitoring traffic in telecommunications net- 
works. The invention may in particular be applied to the 
problem of recognising real-time traffic such as voice 
traffic in packet- or cell-based networks through network 
traffic characterisation. 

[0002] In modem telecommunications networks there 
are a variety of different types of information transmitted 
and received, commonly classified as either real-time 
(RT) traffic or non-real-time (non-RT), data traffic. Voice 
and video are examples of 'real-time' traffic. Internet 
web pages, file transfer, remote log-in and e-mail are 
examples of non-real-time. Different types of network 
can be used to carry the different traffic types from 
source to destination. 

[0003] For example, a data network packages data in 
segments, labels it, and delivers it as a series of 'pack- 
ets 1 to the network for transmission. The packaged data 
may be examined and routed at inter-mediate network 
stages, or nodes. In this description, the term 'packet* is 
used to include the more specific terms such as 'packet 1 , 
'cell', •frame* or 'datagram', which are conventionally 
used in relation to certain of these protocols. Examples 
of such packet transmission systems include Asynchro- 
nous Transfer Mode (ATM), Frame Relay and Internet 
Protocol (IP). In contrast, when using a traditional voice 
network (PSTN), the caller signals to the network the 
requirement for connection (dialling). The network then 
establishes an end-to-end connection path, which can 
be talked over, and the connection released back to the 
network on hanging up. 

[0004] Packet based networks, although designed for 
the needs of data, are capable of carrying real-time traf- 
fic. Where data networks carry RT traffic, for example 
internet telephony and video conferencing, the RT data 
is encoded in packets according to the packet network 
protocols. However, the different transmission require- 
ments of RT and non-RT traffic make it desirable to iden- 
tify the traffic types for various reasons. For example, 
network characterisation and planning, so that the net- 
work can be correctly extended to carry the different traf- 
fic types. Identification of traffic types may also be de- 
sirable for other requirements, for example where voice 
and data are subject to different tariffs. This information 
is also useful when developing new networks, in setting 
and validating network policies and in measuring appli- 
cation conformance. 

[0005] Accordingly, there is a desire to distinguish be- 
tween 'normal' and real-time traffic, including voice, over 
data networks using packet or cell based protocols. 
However, only the source and destination stations typi- 
cally 'know* what type of traffic is actually being carried. 
[0006] The inventors have recognised that it may be 
possible recognise real-time traffic in a cell or package 
based network carrying mixed payloads of real-time and 
non-real-time data through traffic characterisation 



based on statistical measures of the unknown data traf- 
fic, even in the absence of explicit type data. 
[0007] The invention provides a method of classifying 
data traffic in a packet-based communications network 
s conveying different classes of data, including the steps 
of: 



(a) monitoring a communications network for data 
traffic to identify a sequence of data packets of un- 
known class transmitted between a source address 
and a destination address; 

(b) measuring parameters of at least a significant 
part of the packet sequence; and 

(c) deriving from the measured parameters a prob- 
able classification of the data conveyed in the pack- 
et sequence. 
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[0008] The classification may distinguish between re- 
al-time data traffic and other data in the network. The 

20 classification may in particular distinguish between 
voice traffic and other traffic. How much of the sequence 
needs to be measured for the results to be significant 
will clearly depend upon the purpose of the classifica- 
tion, the nature of the parameters being measured, and. 

25 whether they are fixed or subject to change in the course 
of a connection. Video traffic similarly can be detected. 
[0009] Preferably in step (b) a plurality of different pa- 
rameters are measured, while in step (c) said classifi- 
cation is determined by a combination of processes 

30 based on different parameters, the results of each proc- 
ess being combined with the others in accordance with 
a specific weighting. 

[0010] The measured parameters may be coding at- 
tributes of packets in the sequence. For example, cer- 

35 tain types of transport protocol used and specified within 
the packets, and/or certain error protection protocols, 
may be particularly associated with real-time traffic, 
while others are generally used for general data traffic, 
without the need for actual knowledge of the data type. 

*o [0011] The measured parameters may alternatively 
or in addition include the duration of said sequence. Se- 
quences of longer duration (connections active for a du- 
ration of minutes, rather than a few seconds or less) in 
particular will indicate a high probability of real-time traf- 

*5 fic. 

[0012] The measured parameters may alternatively 
or in addition include correlation between traffic in said 
sequence and traffic in a further sequence being trans- 
ported from said destination address back to said 

50 source address. In particular, where periods of activity 
in one direction are correlated with periods of inactivity 
in the reverse direction, this can be used as an indicator 
of duplex voice or videoconference traffic. 
[0013] The measured parameters may alternatively 

55 or in addition comprise timing parameters of individual 
packets within the sequence. Statistical analysis of such 
parameters can be used determine said classification. 
[0014] In one embodiment, the step (b) includes 
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measuring certain timing parameters of events In the se- 
quence, while step (c) includes (i) deriving from the 
measured timing parameters one or more statistical 
properties of packet timing during at (east a part of the 
sequence; and (ii) using said statistical properties to de- 
termine said classification. 

[001 5] Said events may in particular comprise the ar- 
rival of each new packet for the sequence under inves- 
tigation. 

[001 6] The measured parameters may include the in- 
tervals between events within said sequence. In such a 
case, for example, uniformity of said intervals over a sig- 
nificant part of the sequence may be used to indicate a 
high probability of real-time traffic. Voice data standards 
typically define a maximum lag of 20ms in the audio co- 
dec, implying that new packets will arrive at approxi- 
mately 20ms intervals 

[0017] The step (c)(i) may include filtering events to 
restrict the events whose measured parameters are in- 
cluded in the derivation of said statistical properties. 
[0018] In the case where sequences to be classified 
as carrying real-time traffic are expected to include dis- 
tinct periods of relative activity interspersed with periods 
of relative inactivity, said filtering may be performed so 
as to eliminate periods of inactivity from consideration 
in deriving said statistical properties. Such filtering can 
be used, for example, to deal with problems associated 
with periods of silence In voice traffic, when there may 
be an absence of detected data packets. 
[0019] In one embodiment, the sequence is divided 
for analysis into a sequence of shorter measurement pe- 
riods, and said filtering is performed by reference to 
measurements from one measurement period at a time. 
For voice connections, a suitable period may be for ex- 
ample 100ms. 

[0020] A number of strategies may be employed to 
limit erroneous measurements. The filtering may oper- 
ate simply to omit or delete certain samples from the 
statistical data, or may modify those samples and/or the 
statistical database in some predetermined way. 
[0021] For example, in afirst embodiment, only meas- 
urement periods preceded by periods containing signif- 
icant activity are included in the statistical derivation. In 
an alternative embodiment, the first sample within each 
measurement period is discarded to eliminate bias in the 
measurements made. As an alternative measure having 
the same effect, a separate record of the first sample 
can be kept which is later removed from population col- 
lected in the normal manner. 

[0022] In obtaining measurements, steps can be tak- 
en to improve measurement reliability and to reduce the 
processing burden involved in traffic type evaluation. 
The amount of raw data obtained by monitoring network 
traffic can be reduced by aggregating data for each 
measurement period, and optionally for groups of meas- 
urement periods. For example, summing the samples 
and the samples squared, while maintaining a count of 
the samples summed in this way, enables a variety of 



statistical processes to be performed. 
[0023] The method may include steps to compensate 
for variations in the packet arrival (or other event) times 
caused by outside influences and to accommodate spe- 
5 cific traffic patterns, such as when the absence of a sig- 
nal can lead to a misinterpretation of the data. To alle- 
viate errors due to such factors the inter-packet arrival 
time can be normalised against an expected arrival time . 
The probe can synchronise an internal time track 
10 against the arriving data packets so as to measure dif- 
ferences between actual arrival times and predicted ar- 
rival times. 

[0024] The measurement may include measure- 
ments of correlation between parameters of traffic in op- 
posite directions of a duplex connection. In particular 
correlation between periods of high traffic in one direc- 
tion and low traffic in the other may be used as a strong 
indicator of voice traffic. In a telephone conversation, for 
example, talk in one direction is generalfy correlated 
with silence in the other. 

[0025] Additional measurements can be used to dis- 
tinguish multiple from single voice circuits and, where a 
connection is carrying multiple voice circuits, to take ac- 
count of the particular attributes of such a connection. 
[0026] In one embodiment the timestamping of the 
captured and re-assembled data packets can be carried 
out on closure of the bit stream representing a data 
packet and written contiguous with the packet. This can 
be carried out by a specialist interface card and has the 
advantage of producing accurate timestamps for the 
packets which in turns reduces potential errors. 
[0027] Alternatively, the process of timestamping 
packets can be carried out separately from the detection 
and assembling of data packets. Packet capture can be 
carried out by standard interface means and times- 
tamped by separate means. 

[0028] The method according to the invention may 
further comprise using the determined classification au- 
tomatically to control configuration of the network. 
[0029] The method may alternatively or yet further 
comprise using the determined classification to report 
usage of the network for accounting purposes. 
[0030] The invention further provides an apparatus for 
of classifying data traffic in a packet-based communica- 
tions network conveying different classes of data, the 
apparatus comprising means arranged to perform the 
steps of a method according to the invention as set forth 
above. 

[0031] The steps of the method as set forth above can 
conveniently be implemented in a single digital proces- 
sor chip, although of course hard-wired or "pure soft- 
ware" arrangements could be used instead. 
[0032] The above and other features, together with 
their respective advantages, will be apparent to the 
skilled reader from the description of specific embodi- 
ments which follow. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

[0033] Embodiments of the invention will now be de- 
scribed, by way of example only, by reference to the ac- 
companying drawings, in which: 

Figure 1 shows a simplified mode! of a mixed tele- 
communications and data network; 

Figure 2 illustrates differences in call lengths be- 
tween real-time and non real-time traffic within a 
mixed network; 

Figure 3 illustrates differences in packet delays be- 
tween real-time and non real-time traffic packets 
within a mixed network; 

Figure 4 shows schematically a process for the rec- 
ognition of real-time traffic, according to one em- 
bodiment of the invention; 

Figure 5 illustrates a first measurement scheme im- 
plemented within the process of Figure 4; and 

Figure 6 illustrates the occurrence and compensa- 
tion of cell delay variation within the process of Fig- 
ure 4. 

DETAILED DESCRIPTION OF THE EMBODIMENTS 

[0034] Figure 1 shows a simplified model of a typical 
cell- or packet-based telecommunications and data net- 
work 5. Such a transport network typically comprises 
cell or packet switches 10 connected by bearers 15. 
Each bearer is in this example an optical fibre, carrying 
packetised data with both routing information and data 
"payload" travelling in the same data stream. 
[0035] Various devices are attached to the network. 
For example, local area networks (LANs) 20 and private 
branch exchanges (PBXs) 25. Over this network the 
payload may comprise a mixture of voice traffic and/or 
other data types. Different cell and packet transmission 
systems protocols are accommodated. Examples 
shown are connections 35 to Frame Relay Gateway and 
asynchronous transfer mode (ATM) equipment, while 
other possibilities are so-called datagram networks and 
Internet Protocol (IP). Hereinafter the term 'packet* shall 
be taken to include such equivalents as 'eel!', 'frame' and 
'datagram', which are often used in relation to these dif- 
ferent protocols. 

[0036] Possible monitoring sites on various bearers 
in the network are shown at 40 and elsewhere. A net- 
work probe 45 can be attached at such sites in order to 
monitor and analyse network traffic characteristics over 
a circuit connecting a source address and a destination 
address. 

[0037] In developing and maintaining a mixed servic- 
es network it is desirable to monitor the type of traffic. 



This may be to allow the service provider to apply dif- 
ferent tariffs to different traffic types, or for technical rea- 
sons to ensure adequate network performance. 
[0038] By processing and analysing traffic packet da- 

5 ta gathered the inventors have recognised that it is pos- 
sible to establish the probability of whether or not the 
traffic is real-time or data traffic. To recognise RT traffic 
within a network, there is proposed a process for recog- 
nising automatically the patterns that are common within 

10 RT traffic that are absent within non-RT traffic and vice- 
versa. RT traffic has the following generalised charac- 
teristics, any or all of which can be exploited in such a 
process: 

*s 1 . Long Duration Of The 'Call'. 

[0039] Figure 2 illustrates schematically differences 
between RT traffic A and non-RT traffic B within a mixed 
network, showing RT traffic call lengths 50 and non-RT 

20 traffic call lengths 55. Whereas a voice or video (real- 
time) call can be of minutes duration a data (non-real- 
time) call is typically less than a second, or only a very 
few seconds. Well known examples of data calls such 
as internet web connections may appear to last a long 

25 time. However, because loading a web page involves 
loading of many separate elements, each one of which 
is a TCP connection of its own, the duration of the calls 
is short. 

30 2. Non-Error Corrected Coding. 

[0040] Whereas most data calls use an error correct- 
ing transmitting coding, for example TCP (transmission 
control protocol), real-time calls use a no n -error correct - 
35 ing coding such as User Datagram Protocol (UDP). 

3. Regular traffic. 

[0041 ] Figure 3 illustrates differences in packet delays 

40 between RT traffic A and non-RT traffic B within a mixed 
network Traffic packets 60 and various intervals 65, 70, 
75 between successive packets are shown . The nature 
of RT traffic by its very nature imposes time constraints 
on the transmission of packets. In the case of real time 

45 traffic A the packets 60 are separated by regular inter- 
vals 65, typically of 20ms for voice traffic. For non -real- 
time traffic the intervals 70, 75 can be widely variable 
between packets. The requirements of data within a net- 
work impose few, if any, real-time constraints upon de- 

50 livery as data integrity is a more important requirement. 
Non-RT traffic has none of the constraints that RT traffic 
has as far as being delivered regularly are concerned. 
Data transfer integrity is ensured by re-transmitting data 
that was lost or corrupted by the network. Such re-trans- 

55 missions take extra time, and delay the delivery of later 
data whilst the current data is corrected. Real time data 
such as voice or video on the other hand requires real 
time delivery of subsequent data, even at the expense 
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of non-delivery or delivery of corrupt data. In a cell or 
packet network, real-time traffic is coded (by a ■codec") 
and emitted into the network at regular intervals. This 
interval must be kept small to give the real-time nature 
of the traffic, even if it results in data units that are small- 
er than would be chosen for transmission efficiency rea- 
sons. For voice an inter-packet delay of 20ms is man- 
dated. The non-RT traffic packets may also be transmit- 
ted in grouped in bursts with very small intervals be- 
tween packets in a group but with comparatively large 
intervals between groups. 

4. Silence. 

[0042] Voice is a special form of RT data flow, in that 
the roles of the two end point swap many times during 
the connection. Whilst one party talks the other listens, 
and then the roles are reversed. Therefore, voice traffic 
can be characterised by periods of activity (high 
throughput) followed by periods of silence (low through- 
put). 

[0043] Although each of the characteristics listed can 
be interpreted as an indicator of voice traffic is being car- 
ried over a bearer, no single one can give a 1 00% cer- 
tainty of this. In order to achieve a reasonable degree 
of certainty the different indicators are weighted and 
evaluated together, in embodiments of the present in- 
vention. 

Implementation 

[0044] A probe 45 can be connected to the network 
15 at various points 40 in order to monitor a network 
circuit. The term n probe a is used herein to refer to a func- 
tionally self-contained system or sub-system designed 
to carry out the required analysis for a bearer in a net- 
work circuit. A probe unit can be implemented in differ- 
ent ways with differing levels of hardware and software 
implementation to carry out the packet capture and anal- 
ysis. A probe may include separate modules to carry out 
such operations as capturing the data packet and then 
interpreting the actual packet or other data analysis. 
[0045] A number of issues are raised when such anal- 
ysis is considered. For example, in the recognition of 
real-time traffic as opposed to data traffic, a related se- 
quence of packets must first be identified and analysed. 
Capture and analysis of such a sequence or "flow" of 
packets requires a great deal of probe system resources 
for measurement storage. Other measurement issues 
must also be addressed, such as establishing accurate 
measurement methods to deal with variations in packet 
arrival times and inter-packet delays, forms of "jitter" 
commonly referred to herein as cell delay variation 
(CDV). 

[0046] Figure 4 is a top level block diagram showing 
one example of how the process for the recognition of 
real-time traffic can be implemented. A network signal 
80 is monitored by Media Access Connection (MAC) 



hardware 82. A clock 84 provides the necessary timing 
requirements for the probe. The MAC module 82 is cap- 
tures the packets on the network circuit being moni- 
tored. A timestamping component 86 then timestamps 

5 each recognised packet on arrival and a flow recognition 
component 88 recognises and labels packets belonging 
to the same data sequence, or flow. 
[0047] A flow characterisation component 88 charac- 
terises the timestamped sequence. This is carried out 

10 by making a series of measurements relating to the flow 
that are indicative of real-time traffic. Other calculations 
relating to measurements taken can also be performed 
at this stage. A selection of measurement sources, re- 
sults of measurements of call duration, coding type, jitter 

*5 are fed to a correlator component 92 which produces an 
output 94 which indicates as to whether the flow does, 
or does not, contain real-time data such as voice or data. 
[0048] A 'flow' is defined here as a sequence of pack- 
ets delivered between the same source address and 

so destination address, constituting a network circuit, or 
part thereof. A flow commences with the first packet and 
terminates with the last packet. The termination condi- 
tion is when the connection times out. 
[0049] A typical example of such an implementation 

25 might include MAC or other suitable interface hardware, 
an embedded processor, and a real-time clock of appro- 
priate resolution and stability for the network circuit un- 
der scrutiny. The MAC hardware or the processor can 
be used to produce a timestamp for each data packet 

30 received and these timestamps converted to flows. The 
processor can then characterise the flows accordingly, 
either as real time (for example voice) or non-real time 
(for example web data). 

[0050] The embedded processor controls the MAC 
3s and analyses the packets captured by the MAC. The 
processor is capable of carrying out flow recognition, 
protocol decoding, and traffic characterisation, using the 
routing information and traffic type carried in the pack- 
ets. The timestamps are also used to characterise the 
40 flow. 

[0051] A number of methods can be implemented by 
the flow characterisation component 80 of the probe. 
The characterisation of real-time traffic can generally be 
carried out by monitoring flow types and flow duration 

45 between two end points. Data calls can be distinguished 
from 'real-time 1 calls by the protocol being used to trans- 
mit them and the duration they are transmitted for. One 
can determine voice or video from data traffic using in- 
dicators such as, for example, transmission error coding 

so (TCP for data, UDP for voice) and call duration (sub-one 
second for data compared with minutes for voice). 
Measurement methods can also be split broadly into 
simplex and duplex types, which shall now be dis- 
cussed. 

55 

Simplex Connections 

[0052] For cases of transmission of data in one direc- 
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tton only, that is simplex connections, a number of meas- 
urements are carried out in order to ascertain whether 
or not the flow is carrying real-time data traffic or not. 

Characterisation Of RT Traffic By Inter-Packet Delay 

[0Q53] It is possible to recognise real-time traffic by 
monitoring packet inter-arrival time (inter-packet delay) 
measurements of the traffic. This can distinguish real- 
time traffic from non-RT traffic because RT traffic, when 
carried over a packet network, has a source codec out- 
putting data at a regular rate. Hence the inter-arrival time 
of a RT data stream will be highly correlated to a con- 
stant value. AO packet inter-arrival times can considered 
as a set upon which standard statistical analysis can be 
performed. This follows from the need to transmit pack- 
ets at regular intervals. For example, for voice the mean 
inter-arrival time will be 20ms and will have a very low 
standard deviation. More particularly in 'dimensionless 
units* the ratio of the mean, u., to standard deviation will 
be very high for traffic that has a regular arrival time so 
that a high value of (p/standard deviation) indicates a 
very high probability of RT-traffic. The converse will also 
hold true for non-RT traffic. 

Reduction Of Memory Requirements In Algorithm 

[0054] In order to carry out the necessary measure- 
ments and calculations for flow characterisation one 
must process the raw data obtained from the times- 
tamps and packet inter-arrival times. Measuring and re- 
cording the individual timestamps or inter-packet arrival 
time of each packet would require a great deal of meas- 
urement storage. A reduction in the amount of process- 
ing power and time needed to complete the task can be 
achieved by using a summation of measurements. 
[0055] Hence only the following are required: - 

the sum of values of the inter-packet delay, £d, 
the sum of squares of the value of inter-packet ar- 
rival delay, £d 2 , 

the number of instances of the measure are record- 
ed, N. 

[0056] This method minimises the amount of data that 
need be held at any one time and the amount of process- 
ing power needed to analyse the data recovered. 
[0057] A further advantage of these measures is scal- 
ability. It is possible to accumulate the values of multiple 
periods and the aggregate will deliver the required 
measures for the whole period. In this way the average 
and standard deviation values are determined: 
[0058] The mean i.e. average: 




, and hence Nji=£ji 
[0059] The variance, 

'5 [0060] The standard deviation, 

20 V N-l 

[0061] Other derived measurements can also be de- 
duced, such as the maximum and minimum inter-arrival 
time, max(d) and min(d) respectively. 
25 [0062] Processed measurements are then passed on 
to the correlator component 92 for further analysis. 

Management of Silence 

30 [0063] Monitoring "voice" (as an example of RT traffic) 
requires suppression of monitoring of the arrival time of 
packets during periods of "silence", that is when there 
is little or no information being earned in the signal. This 
is both a necessary modification to accommodate the 

35 one-way nature of voice, and an indication that the con- 
nection does carry voice. That is, while there is traffic 
from A to B, there is no traffic in the direction B to A. The 
algorithm must not only deal with silence, but also the 
presence of silences in the RT traffic stream indicates 

40 that the stream is indeed voice. 

[0064] Similarly video conferencing will exhibit peri- 
ods of silence. The active time will be whilst one camera 
is broadcasting to all other parties, and silence for those 
parties watching where there is no significant signal ac- 

45 tivity. 

[0065] Unless the measurement was suppressed for 
those measures associated with the start of traffic (after 
a "silence") considerable error would be introduced into 
the measurement. That is, the inter-packet delay (the 

so "silence") would corrupt the measurement of average 
and standard deviation of inter-packet delay. 
[0066] The suppression of measurement may be ac- 
complished in a number of ways. Figure 5 illustrates a 
measurement scheme used to manage periods of si- 

55 lence. A typical voice signal will include a flow 1 00 with 
packets and periods of silence 1 05. Measurement buck- 
ets 1 1 0, or measurement periods, are defined which re- 
strict when measurements can be made. The measure- 
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ment buckets may contain flows of packets, flows with 
Eost packets 115, or have zero entries 110. 
[0067] The use of appropriate measurement buckets 
is used in the present example to deal with problems 
associated with silence. Onty measurement buckets 
preceded by non-sl!ence are used In calculations. The 
total measurement period is divided into a sequence of 
measurement buckets, each lasting for example 1 00ms 
for voice. The population for the statistical measurement 
is restricted to those buckets which are preceded by a 
bucket that is also active. This eliminates the bias error 
of a few large inter-arrival times and eliminates delays 
130. 

[0068] Additionally, other constraints on the measure- 
ments are made. 

[0069] An upper bound of acceptable inter-arrival 
times is configured. Only inter-arrival times meeting that 
criterion are counted. 

[0070] Silence manifests itself not only in empty buck- 
ets (such as 120, 130) but also as a very long inter-ar- 
rival time for the first traffic packet after the silence. 
Hence to eliminate this bias, the first sample within a 
bucket is not recorded. Alternatively, a separate meas- 
ure of the first inter-packet arrival time can be kept which 
can be later removed from population collected in the 
normal manner. 

Record And Remove Longest Sample. 

[0071 ] For measurements where there is an extended 
period of silence present additional manipulation of the 
samples may be needed. 

[0072] In order to accommodate extended periods of 
silence it is preferred to eliminate bias in the inter-packet 
arrival time metric. In order to minimise any bias in 
measurement of the average and standard deviation of 
the inter packet arrival time, the maximum and minimum 
inter-packet arrival times are eliminated from the from 
the collected statistics. 

[0073] The maximum and minimum inter-arrival time, 
max(d) and min(d), are used further to ensure that pe- 
riods of silence are handled with properly. Upon the clo- 
sure of a bucket, because time has moved to the next 
bucket, values for max(d) and min(d) are removed from 
the measurement set. Silence will be the inter-arrival 
time of the first element, which will also be the largest. 
Hence upon closure of the bucket, the N, Ld, Zd 2 of the 
first and last elements are removed. 

Eliminating Double Counting Of Cell Delay Variation 
(Jitter) 

[0074] Figure 6 shows examples of cell delay varia- 
tion, or jitter, in a mixed network for data packets. 
[0075] A source codec sources data packets at regu- 
lar intervals 150. However, the network can introduce a 
delay 155 in these packets so that their inter-arrival 
times differ from what was expected, as shown at 160. 



Variations in the network system can lead to lengthened 
cell delays 165, and shortened cell delays 1 70. 
[0076] For voice, the source transmits all packets with 
a ceil delay of 20ms, but at a monitoring point, and the 
5 receiver, the delay will be different because the network 
may delay each packet by a different amount. 
[0077] Network delay can be considered to consist of 
three parts: 

10 . the fixed 'speed of light* part, 
the fixed serialisation delay, 

the variable queuing delay in the network switching 
elements. 

is [0078] Given that the source is regular, one delay will 
cause first a lengthened packet delay 1 65 followed by 
a reduced inter packet delay 170 in the next. In the 
measurement scheme as described so far this would 
have a double effect in the measurements and statistics, 

so although there is only one delay 155 as the cause. 
[0079] To eliminate this double error for one cause, 
the inter-packet arrival time is normalised against an ex- 
pected arrival time. The probe 45 synchronises an in- 
ternal time track against the arriving cells rather than 

25 measure the inter-ceil/ packet delay. Then the difference 
between actual arrival time and the predicted arrival is 
measured so that the jitter is measured directly. 
[0080] This measure of jitter eliminates possible dou- 
ble counting of cell delays 155. The internal time track 

30 in synchronised by using a low-pass filtered version of 
the incoming cells. 

Estimating Cell Loss 

3s [0081] By noting the presence of a regular traffic flow, 
the absence of packet within a stream can be recog- 
nised as a measure of toss. 

[0082] The probe may not see all packets within a flow 
because the network can loose packets and the network 
40 can re-route packets around the probe since a packet 
switched network is not necessarily connection orientat- 
ed end to end. 

[0083] However in certain networks that are connec- 
tion orientated, such as Asynchronous Transfer Mode 

4 $ (ATM), the probe can be placed so that it sees all the 
traffic between two end points. An example of this would 
be probing the edge connection of a network. In these 
cases loss can be determined: if no packet arrives for 
time bucket N, and there is only 1 packet in each of buck- 

so ets N- 1 , N+ 1 etc., then loss has occurred. These time 
buckets are synchronised with the traffic and so one 
measure per bucket is expected. This contrasts with the 
previous measures where buckets were only small 
enough to allow measurements during the periods of ac- 

55 tivity between periods of silence, for example, 20ms in 
the first case, and 1s in the second. Two or more packet- 
based processes may thus be conducted in parallel, 
with different sized buckets for each. 
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Packet Content 

[0084] No use is made of the contents of the packets, 
in the present example, only their routing information 
and their arrival times. In other embodiments, one could 
for example can analyse their size to determine whether 
it was fast versus slow action video. 

Duplex Connections 

[0085] The following measures are possible where 
one has access to a bi-directional, or duplex flow. 

Silence as en Indication of Voice 

[0086] Noting that there are periods of silence, and 
that these periods of silence correlate with periods of 
activity in the reverse direction is an indication that there 
is voice communication between the two ends. 

Distinguishing Single Voice And Multiple Voice Circuit 

[0087] Given that a connection is deemed to be car- 
rying voice using the aforementioned methods, it can be 
determined whether the circuit is being used for a single 
voice circuit, (a single session between two users) or 
many (e.g. a connection between 2 PABX's). 
[0088] Assume that a circuit is judged be voice, be- 
cause of its RT nature. If the connection does not exhibit 
silence periods, and if the data transfer content is larger 
than expected from a voice-coding scheme, then the 
connection is of multiple speech circuits. The corollary 
is that if it exhibits silence periods, and if the silence pe- 
riods match active periods in the reverse direction, then 
the circuit is single channel voice. 

Correlation Function 

[0089] The organisation and comparison of measure- 
ments to evaluate the probability of traffic being real- 
time is carried out within the correlator component 92 of 
the probe. 

[0090] For each measurement type an estimator is 
produced and weighted according to relevance. Some 
measurements are stronger indicators of voice traffic 
than others, for example protocol versus packet activity 
(silence). For example, data packets carried using TCP 
error correcting transmitted over IP would strongly indi- 
cate data traffic. Similarly, a long duration call with pack- 
et inter-arrival times close to 20ms would strongly indi- 
cate voice traffic. Such measures would then be weight- 
ed strongly for either voice or data. Other measure- 
ments may only be weak indicators of voice or data and 
would be weighted accordingly weakly. 
[0091] The skilled reader will appreciate that the in- 
vention is not limited to the specific implementations and 
applications detailed above. It can be implemented in 
various combinations of hardware and software, and 



with our without hardwired or programmable circuits. 
For example, various components of the probe process- 
ing described with reference to Figure 2 could be re- 
placed by a general purpose computer, for example a 

5 personal computer such as a notebook PC, interfaced 
to the network by the appropriate hardware. Another im- 
plementation is a hand-held device with the appropriate 
hardware connectivity and an embedded processor with 
software to support the other functions needed. The 

10 probe system, and particularly the analysis and report- 
ing functions, can be situated physically remote from the 
network circuit to be monitored or integrated into part of 
some other network analysis package. 

15 

Claims 

1. A method of classifying data traffic in a packet- 
based communications network conveying different 

20 classes of data, including the steps of: 

(a) monitoring a communications network for 
data traffic to identify a sequence of data pack- 
ets of .unknown class transmitted between a 

25 source address and a destination address; 

(b) measuring parameters of at least a signifi- 
cant part of the packet sequence; and 

(c) deriving from the measured parameters a 
probable classification of the data conveyed in 

30 the packet sequence. 

2. A method as claimed in claim 1 where the classifi- 
cation is between real-time data traffic and other da- 
ta in the network. 

35 

3. A method as claimed in claim 2 wherein the classi- 
fication in particular distinguishes between voice 
traffic and other traffic. 

40 4. a method as claimed in any of claims 1 or 2 wherein 
the classification in particular distinguishes be- 
tween video traffic and other traffic. 

5. A method as claimed in any preceding claim where 
45 in step (b) a plurality of different parameters are 

measured. 

6. A method as claimed in any preceding claim where 
in step (c) said classification is determined by a 

so combination of processes based on different pa- 
rameters, the results of each process being com- 
bined with the others in accordance with a specific 
weighting. 

55 7. a method as claimed in any preceding claim where 
the measured parameters are coding attributes of 
packets in the sequence. 
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8. A method as claimed in any preceding claim where 
the measured parameters further include the type 
of transport protocol used and specified within the 
packets. 

9. A method as claimed in any preceding claim where 
the measured parameters further include the type 
of error protection protocols used and specified 
within the packets. 

10. A method as claimed in claims 7, 8 or 9 where said 
measured parameters are particularly associated 
with real-time traffic, while others are generally 
used for genera! data traffic, without the need for 
actual knowledge of the data type. 

11. A method as claimed in any preceding claim where 
the measured parameters include the duration of 
said sequence. 

12. A method as claimed in claim 11 wherein sequenc- 
es of longer duration in particular indicate a high 
probability of real-time traffic. 

13. A method as claimed in any preceding claim where- 
in the measured parameters include correlation be- 
tween traffic in said sequence and traffic in a further 
sequence being transported from said destination 
address back to said source address. 

14. A method as claimed in claim 13 where the periods 
of activity in one direction are correlated with peri- 
ods of inactivity in the reverse direction. 

15. A method as claimed in any preceding claim where 
the measured parameters include timing parame- 
ters of individual packets within the sequence. 

16. A method as claimed in claim 15 where statistical 
analysis of the parameters determines said classi- 
fication. 

1 7. A method as claimed in any preceding claim where- 
in step (b) includes measuring particular timing pa- 
rameters of events in the sequence 

18. A method as claimed in claim 17 wherein step (c) 
includes (i) deriving from the measured timing pa- 
rameters one or more statistical properties of pack- 
et timing during at least a part of the sequence; and 
(ii) using said statistical properties to determine said 
classification. 

19. A method as claimed in claims 17 or 18 where said 
events in particular comprise the arrival of each new 
packet for the sequence under investigation. 

20. A method as claimed in any of claims 17,18 and 1 9 



wherein the measured parameters include the in- 
tervals between events within said sequence. 

21. A method according to claim 20 wherein the uni- 
s formity of said intervals over a significant part of the 

sequence is used to indicate a high probability of 
real-time traffic. 

22. A method according to claim 21 wherein the inter- 
na vals have a maximum duration of 20ms. 

23. A method according to any of claims 1 8 to 22 where- 
in the step (c)(i) includes filtering events to restrict 
the events whose measured parameters are includ- 
es ed in the derivation of said statistical properties. 

24. A method according to claim 23 wherein said filter- 
ing is performed so as to eliminate periods of inac- 
tivity from consideration in deriving said statistical 

20 properties. 

25. A method according to claim 24 wherein said filter- 
ing is used to deal with problems associated with 
periods of silence in voice traffic, when there is an 

25 absence of detected data packets. 

26. A method according to any preceding claim wherein 
said sequence is divided for analysis into a se- 
quence of shorter measurement periods, and fitter- 

30 ing is performed by reference to measurements 
from one measurement period at a time. 

27. A method according to claim 26 wherein said period 
is typically 100ms. 

35 

28. A method according to claims 25, 26 or 27 wherein 
the filtering operates simply to omit or delete certain 
samples from the statistical data, or modifies those 
samples and/or the statistical database in some 

<o predetermined way. 

29. A method according to any of claims 25 to 28 where- 
in only measurement periods preceded by periods 
containing significant activity are included in the sta- 

*5 tistical derivation. 

30. A method according to any of cla ims 25 to 28 where- 
in the first sample within each measurement period 
is discarded to eliminate bias in the measurements 

so made. 

31 . A method according to any of claims 23 to 28 where- 
in a separate record of the first sample is kept which 
is later removed from population collected in the 

55 normal manner. 

32. A method according to any preceding claim wherein 
the amount of raw data obtained by monitoring net- 
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work traffic is reduced by aggregating data for each 43. 
measurement period, and optionally for groups of 
measurement periods. 

33. A method according to claim 32 wherein summing s 44. 
the samples and the samples squared, while main- 
taining a count of the samples summed in this way, 
enables a variety of statistical processes to be per- 
formed. 

10 45. 

34. A method according to any preceding claim wherein 
there is included steps to compensate for variations 
in the packet arrival or other event times caused by 
outside influences and to accommodate specific 
traffic patterns, such as when the absence of a sig- »5 
nal can lead to a misinterpretation of the data. 

35. A method according to claim 31 wherein errors due 
to the inter-packet arrival time are normalised 
against an expected arrival time. 20 

36. A method according to claim 34 wherein the probe 
can synchronise an internal time track against the 
arriving data packets so as to measure differences 
between actual arrival times and predicted arrival 25 
times. 

37. A method according to any preceding claim wherein 
said measurement includes further measurements 

of correlation between parameters of traffic in op- 30 
posite directions of a duplex connection. 

38. A method according to claim 37 where correlation 
between periods of high traffic in one direction and 
tow traffic in the other are used as a strong indicator 35 
of voice traffic. 

39. A method according to claim 38 wherein voice traffic 
in one direction is generally correlated with silence 

in the other. *o 

40. A method according to any preceding claim wherein 
additional measurements are used to distinguish 
multiple from single voice circuits and, where a con- 
nection is carrying multiple voice circuits, to take ac- 
count of the particular attributes of such a connec- 
tion. 

41 . A method according to any preceding claim wherein 
timestamping of captured and re-assembled data so 
packets is carried out on closure of the bit stream 
representing a data packet and written contiguous 
with the packet. 

42. A method according to any of claims 1 to 41 wherein 55 
the process of timestamping packets is carried out 
separately from the detection and assembling of da- 
ta packets. 



A method according to any preceding claim wherein 
the determined classification is used to automatical- 
ly control configuration of the network. 

A method according to any preceding claim further 
comprising using the determined classification to 
report usage of the network for accounting purpos- 
es. 

An apparatus for classifying data traffic in a packet- 
based communications network conveying different 
classes of data, the apparatus comprising means 
arranged to perform the steps of a method accord- 
ing to the invention as set forth in claims 1 to 44. 



10 



EP 1 204 248 A1 




11 



EP 1 204 248 A1 



± ^ >i. 



B 



f-70 I 75 

a ; -i n i it i ii 



FIG. 3 



80- 



84- 
82- 



Network 


o , N 


MAC 


Signal 







„ Timestamping 



90- 



92- 



p 


Flow 




Recognition 



Flow 
Characterisation 



FIG. 4 



EP 1 204 248 A1 




JJJJJJ-LLLLLLl 

/ 155 "\ 

150 — ^ DELAY * * 

M U Ml LU II I 

•\—/ 



m—f ^ LENG THEN ED CDV 

165—/ / 

170-/ SHORTENED CDV 



FIG. 6 



BEST AVAILABLE COPY 



13 



EP 1 204 248 A1 



Eureptan Pvtsnt 
Office 



EUROPEAN SEARCH REPORT 



EP 00 30 9851 



DOCUMENTS CONSIDERED TO BE RELEVANT 



Category 



Citation of document wttrt bxftsstiort. whore eppropiteto, 
of rol event neTiifj e i 



to da#rn 



CLASSnCATION OF THE 



y 

A 



US 6 028 842 A (CHAPKAN ALAN STANLEY JOHN 
ET AL) 22 February 2000 (2000-02-22) 



* column 3, line 7 - column 4, line 43; 
figure 1 * 

* column 5, line 57 - column 6, line 14 * 

W0 98 30059 A (DIAMOND JEFFREY E ;B0URLAS 
YAIR (CA); MCLEOD ROBERT 0 (CA); RUEDA) 
9 July 1998 (1998-07-09) 

* page 18, line 8 - line 25 * 



1-5,7,8, 
10.11. 
15-17, 
20,21.45 
13 



13 



1-12, 
14-45 



H04L12/56 



TECHNICAL RELOC 

(W-CL7) 



H04L 



The present March report has been drawn up for ofi deans 



Ptoaofa 

THE HAGUE 



6 June 2001 



GregoM , S 



8 

§ 

c 

s 



CATEGORY OF CITED DOCUMEKTS 

X : parficxiarty r eajvant W taken atone 

Y : par Bcutart y raaevam V ccm t ua^j wtth another 

document ot the same carieoory 
A i aaohnoloQloa) bscfc^round 
O ! non-awtttan oladoctae 
f* ; ■ iter i nedlaaa document 



T : tTeory or pHncip« underlying (he invention 
E : earflar patent dbcumertt, but pubfishad on, or 

after the flVo Gate 
D '. document cftad n the application 
L : document ctasd tor omer reasons 



& : member of the carre patera famSy, oo ms^ortf nc 



EP 1 204 248 A1 



ANNEX TO THE EUROPEAN SEARCH REPORT 
ON EUROPEAN PATENT APPLICATION NO. 



EP 00 30 9851 



This annex lists the patent family nwnb a u retortng to the paten! documents cfrad In theabo w j m enti oned European search report 
The member* are as contained In the European PatwM Cmoe EOP fle on 

Th • Curop— n Patent Office la In no way labia for thaaa particulars which ere maroly gtven far tha purpose of Information. 

06-06-2001 



Patent docuKMnt 
cftwJln 



PubUcaUon 



Patent famfry 
insmtMifs) 



US 6028842 



22-02-2000 



U0 
UO 
EP 
JP 
US 



9828938 
9828939 
0954943 
2000508145 
6023456 



02-07-1998 
02-07-1998 
10-11-1999 
27-06-2000 
08-02-2000 



W0 9830059 



09-07-1998 



NONE 



deceits about Ws annex :soe Official Journal of the European Patent Offtea. No. 12/32 

B£8Y AVAILABLE QQPY 



1S 



